CVE-2024-6842
Exposure of Sensitive Information in mintplex-labs/anything-llm
Summary
Exposure of Sensitive Information in mintplex-labs/anything-llm
Original description
The description as published by the source.
In version 1.5.5 of mintplex-labs/anything-llm, the /setup-complete API endpoint allows unauthorized users to access sensitive system settings. The data returned by the currentSettings function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com